CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Campay Woocommerce Payment Gateway plugin for WordPress is vulnerable to Unauthenticated Payment Bypass in all versions up to, and including, 1.2.2. This is due to the plugin not properly validating that a transaction has occurred through the payment gateway. This makes it possible for unauthenticated attackers to bypass payments and mark orders as successfully completed resulting in a loss of income.
Explanation of Vulnerability in Simple Terms
The Campay Woocommerce Payment Gateway plugin through version 1.2.2 contains an integrity vulnerability that allows unauthenticated attackers to modify data over the network. The vulnerability requires no user interaction and affects the plugin's core functionality. Site administrators should update to a version newer than 1.2.2 to remediate this issue.
What an attacker can do
Modify payment or transaction data without authentication.
Potential impact on your site
Payment transactions or order data could be altered by attackers, potentially affecting order integrity and customer trust.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
